Bypass censorship and deep packet inspection

[angristan]

Multiple countries make use of DPI like China and Syria, and block OpenVPN packets even when using classic and simple obfuscation techniques like TCP:443 or UDP:53

Since multiple users have expressed interest in bypassing DPI, it would be great if the script could help with that.

Here is the DPI-bypassing/obfuscation techniques I've found so far. Before implementing them maybe we should focus on the most effective/secure/recent/maintained ones.

This is issue is a draft, a WIP, any feedback is welcome.

tls-crypt

Which we support as it is native to OpenVPN since 2.4.

It is not made for obfuscation but does happen to help sometimes.

Obfsproxy

An obfuscating proxy written in Python by the Tor Project.

Todo: #417

It seems unmaintained since 2014.

• https://pypi.org/project/obfsproxy

The XOR patch

A patch to apply the OpenVPN source code (client/server), maintained by the Tunnelblick developers.

Todo: #347

Has not been audited.

• https://tunnelblick.net/cOpenvpn_xorpatch.html
• https://github.com/clayface/openvpn_xorpatch

stunnel

A TLS proxy.

• https://www.stunnel.org/

WIP

To study:

• https://www.pluggabletransports.info/transports/
• https://www.pluggabletransports.info/implement/openvpn/
• https://github.com/OperatorFoundation/shapeshifter-dispatcher
• https://github.com/wangyu-/udp2raw-tunnel

[fq111]

Another possibility is OpenVPN over Shadowsocks. You may find some more ideas on https://www.reddit.com/r/circumventcensorship/

[nerull13]

i follow !

[rubenmdh]

I can vouch for stunnel. I have even used it in conjunction with your script and it would be a nice have-to as an automatic install.

This is another option with configurable accounts and bandwidth limitations. I have used it with Shadowsocks but I still have to try it with OpenVPN. A Shadowsocks+Cloak autoinstaller script is available here as reference.